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□ 



Mobile Security Technologies Tj 



Security Architecture 
Operating Systems Security 
Software Tamper Resistance 
Mobile Code Security 
Physical Tamper Resistance 
Communications Security 
Cryptographic Protocol 
User Identification 
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□ 



Adversarial Analysis n 



Security assessment of biometric user identification 
systems should be conducted not only for the accuracy 
of authentication , but also for security against fraud. 



In this presentat 
Systems which 
Mobile Termina 




focus on Fingerprint 
ome widespread for 



\ 

Examine Adversarial Analysis as A Third Party 

• Can we make artificial fingers that fool fingerprint systems? 

# What are acceptance rates? 

/ 
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Fingerprint Systems Tj 



Typical structure of a fingerprint system 




• Optical sensors and Well” Detection 

• Capacitive sensors 

• Thermal sensors, Ultrasound sensors, etc. 
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A Risk Analysis for Fingerprint Systems 



Attackers may present 

1 ) the registered finger, 

by an armed criminal, under duress, or with a sleeping 
drug, 

2) an unregistered finger (an imposter's finger), 
i.e., non-effort forgery, 

3) a severed fingertip from the registered finger, 

4) a genetic clone of the registered finger, 

5) an artificial clone of the registered finger, and 

6) the others, 

such as a well-known method as a “ fault based attack. ” 
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Fraud with Artificial Fingers 



Part of patterns of dishonest acts with artificial fingers 
against a fingerprint system. 





Verification / Identification 


Enrollment 


L(X) 


A(X) 


L(Y) 


A(Y) 


A(Z) 


L(X) 


(1) 


(2) 


— * 


— 


— 


A(Y) 


— 


— 


(3) 


(4) 





A(Z) 


— 


— 


— 


— 


(5) 



L(X): A Live Finger corresponding to Person X 
A(Y): An Artificial Finger corresponding to Person Y 
A(Z): An Artificial Finger corresponding to Nobody 
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Fraud with Artificial Fingers I 



Y obtains A(X). 




Difttrihntirm of A(Yk 
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Fraud with Artificial Fingers II 



X obtains A(Y). 




X enrolls A(Y). 




1 



A(Y) 



X 



X 



A(Y) 



Distribution of A(Y)s 



A(Y)s 
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Fraud with Artificial Fingers III 






Distribution of A(X)s 
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Mapping a Fingerprint onto Artificial Fingers Tj 



Finegerprint 

e.g., Live Fingers, Generators, ... 

Impression 

e.g., Molds, Residual Fingerprints, ... 

V 7 

Artificial Finger 
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Known Results 



Process 0 

(1) Finger 

(2 ) Mold 

(3) Silicone Rubber Finger 
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Light Source 



Fact 



Optical Sensor 




Often Accepts 
Silicone Rubber Fingers 



Capacitive Sensor 




Array of Electrodes 




Usually Rejects 
Silicone Rubber Fingers 
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Recipe 1-1 



Making an Artificial Finger directly from a Live Finger 



Materials] 



Free molding plastic 




Solid gelatin sheet 


“FREEPLASTIC” 




“GELATINE LEAF ” 


by Daicel FineChem Ltd. 




by MARUHA CORP 









Recipe 1-2 



Making an Artificial Finger directly from a Live Finger 




Put the plastic 
into hot water 
to soften it. 



Press a live finger 
against it. 



It takes around 10 minutes. 



The mold 



Yokohama Nat Univ. Matsumoto Laboratory 






Recipe 1-3 



Making an Artificial Finger directly from a Live Finger 



/*■ 






Preparation of material | 

• A liquid in which immersed gelatin at 50 wt. % . 




Add boiling water (30cc) to solid gelatin (30g) in a 
bottle and mix up them. 

It takes around 20 minutes. 
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Recipe 1-4 



Making an Artificial Finger directly from a Live Finger 




How to make a gummy finger 




Pour the liquid 
into the mold. 



\ 

/ 



Put it into 

a refrigerator to cool 




It takes around 10 minutes. The gummy finger 
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Similarity with Live Fingers 



The photomicrographs of fingers 




(a) Live Finger (b) Silicone Finger (c) Gummy Finger 
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Captured Images 




Captured images with the device C (an optical sensor). 




(a) Live Finger (b) Silicone Finger (c) Gummy Finger 



Captured images with the device H (a capacitive sensor). 




(a) Live Finger (b) Gummy Finger 
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Experiments 



Subjects : five persons whose ages are from 20’s to 40’s 
Fingerprint systems: 11 types 




We attempted one-to-one verification 100 times counting the 
number of times that it accepts a finger presented. 




Types of experiments 



Experiment 


Enrollment 


Verification 


Type 1 


Live Finger 


Live Finger 


Type 2 


Live Finger 


Gummy Finger 


Type 3 


Gummy Finger 


Live Finger 


Type 4 


Gummy Finger 


Gummy Finger 



: : j 
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□ 



The List of Fingerprint Devices Tj 





Hardware Specifications 


Software Specifications 


M ethods 
fo r 

V erification 


M anufacturer / 
Selling Agency 


Product N ame 


Type 


Product 
N umber 


Sensor 


Live and 

Well 

D etection 


M anufacturer / 
Selling Agency 


Product N ame 
(Application) 


Comparison 

Levels 


Device A 


Compaq Computer 
Corporation 


Compaq Stand-Alone 
Fingerprint Identification 
Unit 


DFRD-200 


E03811US001 


Optical 
S ensor 


unknow n 


Compaq Computer 
Corporation 


Fingerprint Identification 
Technology Software 
version 1.1 


1 through 3 


M inutiae 
M atching 


Device B 


MITSUBISHI 

ELECTRIC 

CORPORATION 


Fingerprint Recognizer 


FPR-DT mkll 


003136 


Optical 
S ensor 


unknow n 


S umikin Izumi 
Computer Service co. 
Ltd. 


SecFP VI. 11 


Fixed 


M inutiae 
M atching 


Device C 


NEC Corporation 


Fingerprint Identification 
Unit (Prism) 


N7950-41 


9Y00003 


Optical 
S ensor 


unknow n 


NEC Corporation 


B a sic Utilities for 
Fingerprint Identification 


Fixed 


M inutiae 
M atching 
(Minutia and 
Relation) 


Device D 


OMRON Corporation 


Fingerprint Recognition 
Sensor 


FP S- 1000 


90500854 


Optical 
S ensor 


unknow n 


OMRON Corporation 


" YU BI PASS " U.are.UD 
Fingerprint Verification 
S oftware 


Fixed 


M inutiae 
M atching 


D evice E 


Sony Corporation 


Sony Fingerprint 
Identification Unit 


FIU-002-F11 


00709 


Optical 
S ensor 


Live Finger 
detection 


TSUBASA SYSTEM 
CO., LTD. 


Fingerprint Identification 
U nit W indowsQ 9 5 
Interactive Demo Version 
1 .0 Build 13 


1 through 5 


Pattern 

matching 


D evice F 


FUJITSU LIMITED 


Fingsensor 


FS-200U 


00 AA000257 


C apacitive 
S ensor 


unknow n 


FUJITSU LIMITED 


Logon for Fingsensor V 1 .0 
for W indowsQ 95/98 


Fixed 


M inutiae 
M atching 
(Correlation) 


Device G 


NEC Corporation 


Fingerprint Identification 
Unit (S erial) 


P K-FP002 


0300529S 


C apacitive 
S ensor 


unknow n 


NEC Corporation 


B a sic Utilities for 
Fingerprint Identification 


Fixed 


M inutiae 
M atching 
(Minutia and 
Relation) 


D evice H 


Siemens AG (Infineon 
Technologies AG) 


FingerTIPQ 
EVALUATION KIT 


EVALUATION- 

KIT 


C 98 45 1 - 
D6100-A900- 
4 


C apacitive 
S ensor 


unknow n 


Siemens AG (Infineon 
Technologies AG) 


F ingerTIPG S oftware 
Development Kit (SDK) 
Version: V0. 90, Beta 3 
"Demo Program" 


Fixed 


M inutia 
matching 


Device I 


Sony Corporation 


Sony Fingerprint 
Identification Unit 


FIU-710 


3000398 


C apacitive 
S ensor 


Live Finger 
detection 


S ystemneeds Inc . 


Good-bye " PASSWORD' s 


1 through 5 


Pattern 

matching 


D ev ic e J 


Secugen 


EyeD mouse II 


SMB-800 


9650172004 


Optical 

Sensor 


unknow n 


Secugen 


SecuDesktop 1.55 □ 

□ □ □ 


1 through 9 


Minutia 

matching 


D evice K 


Ethentica 


ethenticatior MS 3 000 PC 
Card 


MS 3000 


M300F200991 


Optical 

Sensor 

j i 


unknown 


Ethentica 


Secure Suite 
Rel easel. 0 


Fixed 


Minutia 

matching 
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Experimental Results 



Making an Artificial Finger directly from a Live Finger 



in 
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ABCDEFGH I J K 

Fingerprint Device 
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Recipe 2-1 



Making an Artificial Finger from a Residual Fingerprint 

Materials 



A photosensitive 
coated Printed Circuit 
Board (PCB) 

“10K” by Sanhayato Co., Ltd . 




Solid gelatin sheet 

“GELATINE LEAF ” 
by MARUHA CORP 
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Recipe 2-2 




Residual Fingerprint 



Enhancing 



Capturing 



Cyanoacrylate 

Adhesive 



Image Processing 



Adobe Photoshop 6.0 



Fingerprint Image 



Printing 



Mask 



Transparent Film 



1 






Exposing 

1 


◄ — 1 

◄ — 




Photosensitive 


l 

Developing 




Coated PCB 




Digital Microscope 




KEYENCE YH6300: 900k pixels 



Inkjet Printer 




Canon BJ-F800: 1200x600dpi 
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□ 



Recipe 2-3 TJ 




An Enhanced Fingerprint A Fingerprint Image 
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□ 



Recipe 2-4 TJ 



Gelatin Liquid 




H 



Put this mold into 
a refrigerator to cool, 
and then peel carefully. 
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3 



The Mold and the Gummy Finger TJ 





Mold: 70JPY/piece Gummy Finger: 50JPY/piece 

(Ten molds can be obtained 

in the PCB.) 
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□ 



Resolution of Fingerprint Images 



Pores can be observed. 





Enhanced Fingerprint 



Captured Fingerprint Image of 
the Gummy Finger 
with the device H (a capacitive sensor) 
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Experimental Results 



from Residual Fingerprints (for 1 subject) 
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Fingerprint Device 
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Characteristics of Gummy Fingers 





Moisture 


Electric Resistance 


Live Finger 


16% 


16 Mohms/cm 


Gummy Finger 


23% 


20 Mohms/cm 


Silicone Finger 


impossible to measure 


impossible to measure 




Pressure Sensor Output (g) 

The compliance was also examined for live and gummy fingers. 
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Conclusions n 



• There can be various dishonest acts using artificial fingers 
against the fingerprint systems. 

• Gummy fingers, which are easy to make with cheep, easily 
obtainable tools and materials, can be accepted by 11 types of 
fingerprint systems. 

• The experimental study on the gummy fingers will have 
considerable impact on security assessment of fingerprint 
systems. 

• Manufacturers, vendors, and users of biometric systems should 
carefully examine security of their system against artificial 
clones. 

• How to treat such information should be an important issue. 
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For Details 




• Paper: 

T. Matsumoto, H. Matsumoto, K. Yamada, S. Hoshino, 

“ Impact of Artificial “Gummy” Fingers on Fingerprint 
Systems” Proceedings of SPIE Vol. #4677, 

Optical Security and Counterfeit Deterrence Techniques IV. 



Yokohama Nat. Univ. 
Matsumoto Laboratory 




